SSL VPN Client - Require Client Certificate

[ddskier]

I' m very frustrated with the SSL VPN " Require Client Certificate" functionality. Fortinet' s documentation isn' t the best on this issue. Support is also taking their sweet time giving me answers that don' t keep refering back to documentation. I' m running 4.0 MR1 - Patch 4. I have purchased a GoDaddy SSL certificate. Installed it on the Fortinet Unit and also installed GoDaddy' s " CA Certificate" on the unit itself. (Per Fortinet Documentation) I went ahead an install the SSL certificate on the client machine under the " Other People" and " Personal" certificate containers. However, no matter what I do, the fortinet unit will not allow my remote user to authenicate while I have the " Require Client Certificate" check box. What am I missing?

[#2]

Hi rlord, I don' t think that' s how it works in the VPN world.... At first I thought the same way as you. But if you read the first few posts on this thread, you will know that all we need is convert the certificate to .p12 that' s why I want the list of steps to convert it.

[rlord]

Hi rlord, I don' t think that' s how it works in the VPN world

Well, I have SSL-VPN working with over 200 users. So, I am pretty sure thats how it works. But what do I know... right?

[#4]

ddskier and g3rman where are you guys? I need your help...

[FortiRack_Eric]

x2cao, I think you are a bit of on re-using a ssl certificate as a client certificate. If you read something on PKI then you' ll learn there are some bits enabled or dis- on a cert for its purpose, on a SSL cert, the purpose is server side auth, not client side. Hence it will never work as the FG init will not auth a client using a cert without client side auth set. Furthermore you might think again on allowing every client to auth presenting a godaddy cert. The solution presented by rlord is a viable one, that I would recommend. Cheers Eric

[ddskier]

x2caso. Here are the steps to create your our CA and client certificate to be used for SSLVPN. Purpose & Scope Client side SSL verification uses a privately generated SSL root and each SSL certificate is privately signed by that root. This method has the advantage allowing system administrator to easily generate a new root and SSL certificates. Since no third party involved in signing those SSL certificate, its security is higher than those signed by the public signing agencies without any additional cost. This process requires the installation of OPENSSL. http://www.openssl.org Procedure 1) Create the Certificate Authority. a) Generate a private key: openssl genrsa -out ca.key 1024 b) Generate a certificate request: (Fill in all the proper fields. ) openssl req -new -key ca.key -out ca.csr c) Self-sign the certificate request: openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt 2) Generate the client key and certificate request key to the CA. a) Generate the client key: openssl genrsa -out client.key 1024 b) Generate the client certificate request: openssl req -new -key client.key -out client.csr c) Sign the certificate request: openssl x509 -req -days 365 -CA ca.crt -CAkey ca.key -CAcreateserial -in client.csr -out client.crt d) Convert client certificate to PKCS#12 format: openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12 Additional Comments For use with the Fortinet unit, the CA cert needs to be imported into it. Then the p12 cert needs to be imported onto the client machine.

[#7]

5/14/2010 7:51:28 AM

I tried following these instructions but when I try to connect using the SSL VPN Client I get the error “Unable to logon to the server. Your user name or password or client certificate may not be configured properly for this connection. (-12)” I checked the settings by turning off the Require Client Certificate then reconnecting -- the connection then worked. I imported the ca.crt (point 1.c) to the CA certificates store -- is this correct? What other trouble shooting steps should I take? Thank you Charlie